This is a courtesy English translation provided for convenience. The original French version (confidentialite.html) is the legally binding text; in case of any discrepancy between the two versions, the French version prevails.
This Privacy Policy describes how Gaspard Vancompernolle, as data controller, collects, uses, retains, and protects the personal data of users of the La Belle Bière mobile application (hereinafter "the Application").
It is drafted in accordance with the General Data Protection Regulation (GDPR – EU Regulation 2016/679) and the amended French Data Protection Act ("Loi Informatique et Libertés", Law No. 78-17 of January 6, 1978).
By creating an account on the Application, you accept the terms of this Privacy Policy. If you do not accept these terms, please do not use the Application.
The controller responsible for processing your personal data is:
Gaspard Vancompernolle
Private individual – operating in a personal capacity
Marcq-en-Baroeul, 59700, France
Email: contact@labellebiere.com
Hereinafter referred to as "the Publisher" or "we".
We only collect data necessary for the operation of the Application. No data is collected for advertising or commercial purposes.
When you create your account, we collect the following data:
If you sign in via Apple Sign-In (iOS only), Apple provides the Application with your email address (or an anonymized relay address if you choose to hide it). We then automatically create a profile with the information provided. The remaining data (username, city, date of birth) is requested from you the first time you sign in.
When you publish a beer experience, we collect:
Geographic location (latitude and longitude) may be collected when creating a post, in order to automatically geolocate the nearest establishment. This collection is optional and requires your explicit authorization via the device's permission request. You may refuse or revoke this permission at any time in your device's settings.
We do not carry out any continuous tracking of your geographic location.
Use of the social features generates the following data:
During registration or from the Application's settings, you may provide your phone number so that other users who have you in their address book can find you. This number is hashed (SHA-256) directly on your device before being sent: we never receive or store your number in plain text on our servers, only its cryptographic fingerprint.
If you use the "Friend suggestions" / "Invite friends" feature, the Application requests access to your address book (contact names and phone numbers), subject to your explicit authorization via the device permission. Before the first such request, an explanation screen is shown within the Application to inform you of this processing, in addition to the operating system's own permission prompt. Your contacts' phone numbers are hashed locally on your device; only these fingerprints are sent to our servers to be compared against other users' hashed numbers. Your contacts' plain-text names and numbers never leave your device and are neither transmitted to nor stored by us.
This feature necessarily involves data relating to third parties (your contacts) who may not have created an account on the Application and therefore have not seen this Policy. We limit this processing to what is strictly necessary: fingerprints computed from your contacts' numbers that do not match any existing user are not retained by our servers — they are used only for the one-off comparison at the time of your request, then immediately discarded; and no invitation is ever sent automatically — you choose, contact by contact, whether to send an invitation by text message via your device's native messaging app (the Application then has no knowledge of whether it was sent or of its content). You may revoke this permission at any time in your device settings, and disable your own phone number from the Application's settings.
We use PostHog (audience measurement and usage statistics) and Sentry (error and crash tracking) to understand how the Application is used and to fix bugs. Details of the data shared with these providers are set out in Article 5.
Each time you successfully sign in to your account (password or Sign in with Apple), we record the date, a device label (model and operating system, as reported by your device) and an approximate location (city, region, country) derived from your IP address at the time of sign-in. This history is available from the Application's settings ("Login history") and lets you spot a sign-in you don't recognize.
The IP address itself is never stored: it is only used on the fly by our servers to determine the approximate location, then immediately discarded.
The Application accesses the camera, with your permission, for two purposes: taking photos of beers to publish, and scanning a bottle's barcode. During a scan, the camera image is processed locally on your device to extract the barcode: it is neither stored nor transmitted. Only the barcode (a string of digits) is then used, first against our internal database and then, if unknown, sent to the public Open Food Facts database to suggest a product name. No personal data and no image are sent to that service.
When you mark a beer as tasted, the rating and the personal comment you attach to it are stored in your account. The personal comment remains strictly private: it is never shown on your public profile or visible to other users. This data is included in the export of your data (Article 8.4).
We do not transfer or sell your data to third parties for advertising purposes. We do not use any advertising network or data broker. Details of the analytics and diagnostics tools we use are set out in Article 5.
| Purpose of processing | Data concerned | Legal basis (GDPR) |
|---|---|---|
| Creation and management of the user account | Email, password, username, first name, last name, city | Performance of a contract (Art. 6(1)(b)) |
| Verification of legal age (18 years old) | Date of birth | Legal obligation – "Loi Évin" (Art. 6(1)(c)) |
| Authentication via Apple Sign-In | Email (or Apple relay address) | Performance of a contract (Art. 6(1)(b)) |
| Displaying posts and the news feed | Photos, beer brand, type, rating, description, username | Performance of a contract (Art. 6(1)(b)) |
| Geolocation of posts | Latitude, longitude | Consent (Art. 6(1)(a)) |
| Social features (follows, comments, votes) | Social interaction data | Performance of a contract (Art. 6(1)(b)) |
| Sending functional push notifications | Push notification token | Consent (Art. 6(1)(a)) + Legitimate interest (Art. 6(1)(f)) |
| Rankings, statistics, and regional personalization | City, posts, ratings | Legitimate interest (Art. 6(1)(f)) |
| Content moderation and Application security | Reports, profile data, posts | Legal obligation (Art. 6(1)(c)) + Legitimate interest (Art. 6(1)(f)) |
| Improving the search experience | Search history | Legitimate interest (Art. 6(1)(f)) |
| Connecting you with contacts who are already users ("Friend suggestions") | Phone number (hashed), fingerprints of address book numbers | Consent (Art. 6(1)(a)) |
| Audience measurement and product improvement (PostHog) | Pseudonymous technical identifier, usage events (e.g. post created, follow) | Legitimate interest (Art. 6(1)(f)) |
| Technical diagnostics and bug fixing (Sentry) | Crash reports, error logs, technical device information | Legitimate interest (Art. 6(1)(f)) |
| Sending transactional emails (Pro status decision, account suspension, data export) | Email, username, notification content | Performance of a contract / Legal obligation (Art. 6(1)(b)/(c)) |
| Account security (login history) | Sign-in date, approximate location (city/region/country), device type | Legitimate interest (Art. 6(1)(f)) |
| Data category | Retention period |
|---|---|
| Profile data (email, name, username, city, date of birth, bio, avatar) | Duration of the account + 30 days after deletion request |
| Posts (photos, descriptions, ratings, location) | Duration of the account + 30 days after deletion request |
| Social interactions (follows, comments, votes) | Duration of the account + 30 days after deletion request |
| Search history | Duration of the account + 30 days after deletion request |
| Login history (date, approximate location, device) | Duration of the account + 30 days after deletion request |
| Push notification token | Duration of the account (deleted upon sign-out or account deletion) |
| Session token (stored locally) | Until sign-out or session expiry |
| Content reports | 5 years from the date of the report (legal obligation under the LCEN) |
| Phone number (hashed) | Duration of the account + 30 days after deletion request, or until manually disabled from settings |
| Address book number fingerprints ("Friend suggestions") | Not retained: used on the fly to establish matches, then immediately discarded |
| Audience measurement data (PostHog) | Per the provider's retention policy (see Article 5) |
| Crash and error reports (Sentry) | Approximately 90 days (provider's default retention period) |
When you request deletion of your account from the Application's settings, all of your personal data is permanently deleted within a maximum of 30 days, including your photos stored on Supabase Storage, your posts, comments, and profile data. No archived backup is retained beyond this period.
Your personal data is never sold or transferred to third parties for commercial or advertising purposes.
For the technical operation of the Application, we use the following processors, bound to the Publisher by a GDPR-compliant data processing agreement:
| Processor | Role | Server location | Data transmitted |
|---|---|---|---|
| Supabase Inc. | Database, authentication, file storage (photos, avatars) | Ireland (European Union) | All account, post, interaction, and photo data |
| Apple Inc. | Authentication via Apple Sign-In (iOS only); push notification service (APNs) | United States / European Union (depending on the service) | Email or relay address; push notification token |
| Expo (Expo Technologies Inc.) | Mobile push notification infrastructure | United States | Push notification token |
| PostHog | Audience measurement and usage statistics for the Application | European Union (Frankfurt, Germany – "PostHog Cloud EU" hosting) | Pseudonymous technical identifier, usage events (e.g. post created, follow) |
| Sentry (Functional Software, Inc.) | Production error and crash tracking | European Union ("EU" data residency region) | Crash reports, error logs, technical device information |
| Brevo (Sendinblue SAS) | Sending transactional emails (Pro status decisions, suspension notices, sending your data export) | France (European Union) | Email, username, content of the relevant notification |
No other third party has access to your personal data. We do not use any advertising network and do not share any data with data brokers. PostHog and Sentry are analytics and technical diagnostics tools whose use is detailed above and in Article 2.7; they are not used for advertising or commercial profiling purposes.
The Application's primary hosting is provided by Supabase on servers located in Ireland (European Union). Your profile data, posts, and photos do not leave the EU as part of this processing.
Two auxiliary services involve processing outside the EU:
These transfers are strictly limited to what is necessary to provide the corresponding features.
Our other providers (PostHog, Sentry, Brevo) host the relevant data on servers located in the European Union and therefore do not involve any transfer outside the EU.
The Publisher implements appropriate technical and organizational measures to protect your data against destruction, loss, alteration, disclosure, or unauthorized access, in particular:
Despite these measures, no system is infallible. In the event of a data breach likely to result in a risk to your rights and freedoms, the Publisher undertakes to notify the competent authorities (CNIL) within the legally required timeframe and to inform you as soon as possible if your security is compromised.
In accordance with the GDPR and the French Data Protection Act, you have the following rights regarding your personal data:
You may obtain confirmation that your data is being processed and request a copy of it, as well as all information relating to its processing (purposes, retention period, recipients, etc.).
You may correct or complete inaccurate or incomplete data. Most profile information (username, city, bio, avatar) can be edited directly from the Application's settings.
You may request the deletion of your account and all associated data from the Application's settings ("Delete my account" section). Deletion takes effect within a maximum of 30 days of your request and includes:
Deletion is irreversible. Reports you have made may be retained for 5 years for legal purposes (LCEN), in anonymized form.
You may request to receive your personal data in a structured, commonly used, machine-readable format, and to transmit it to another controller. To exercise this right, contact us at the address indicated in Article 11.
You may object at any time to the processing of your data based on the Publisher's legitimate interest (in particular search history, regional rankings, and statistics). Your objection will be reviewed as soon as possible.
You may request the restriction of the processing of your data in the cases provided for by the GDPR (contesting accuracy, objection under review, data needed for legal proceedings).
For processing based on your consent (location, push notifications), you may withdraw this consent at any time without affecting the lawfulness of processing carried out prior to the withdrawal:
If you believe that the processing of your personal data constitutes a breach of the GDPR, you have the right to lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL):
To exercise any of these rights (other than withdrawal of consent, which is managed directly from the Application), contact us at the address indicated in Article 11. We will respond within a maximum of 30 days of receiving your request. We may need to verify your identity before processing your request.
The La Belle Bière mobile application does not use cookies in the traditional (web technology) sense. It does not integrate any advertising network or any third-party tracker for advertising purposes. It does, however, use PostHog (audience measurement) and Sentry (technical diagnostics): see Article 2.7 and Article 5 for details of the data involved.
The only data stored locally on your device is:
This data is stored on your device and is not transmitted to third parties. You may erase it by uninstalling the Application.
The website publishes the beer sheets and the bar guide. It measures its audience with GoatCounter, a tool that sets no cookies and assigns no persistent identifier to visitors: only aggregate figures are kept (page views, referrer, device type). The website stores in your browser (local storage) that you confirmed you are 18 or older, so it does not ask again; you can erase it by clearing the site's data in your browser.
Public posts on the website. Photos of public posts linked to a bar may appear on that bar's web page, without username, profile picture or link to the profile. Posts from private accounts never appear there. A deleted post, or an account switched to private, disappears from the website immediately. Ratings shown on the website are averages, never individual ratings.
The Application is strictly reserved for individuals 18 years of age or older. We do not knowingly collect personal data relating to minors. Date of birth is collected during registration to verify this condition.
If you believe that a minor has created an account on the Application, please inform us at the contact address indicated in Article 11. We will delete the account and associated data as soon as possible.
The Publisher does not carry out formal identity verification (identity document). The declaration of legal age is made on the user's honor at the time of registration.
The Publisher reserves the right to amend this Privacy Policy at any time, in particular to reflect changes in legislation, CNIL recommendations, or technical developments of the Application.
In the event of a substantial change, users will be informed via a notification within the Application and/or by email, at least 15 days before the new provisions take effect. The update date shown at the top of the document indicates the version in force.
Continued use of the Application after the new Policy takes effect constitutes acceptance of it.
For any question, request to exercise your rights, or complaint regarding the processing of your personal data, you may contact the data controller:
The Publisher undertakes to respond to any request within a maximum of 30 days of receipt.
© 2026 La Belle Bière – Gaspard Vancompernolle. All rights reserved.
Privacy Policy version 1.3 – Last updated: October 21, 2026